🇪🇸
Michael McCarthy
2026-09-30 05:03:33
(2 weeks ago)
Web Spam
🇺🇸
TPI-Abuse
2026-09-29 19:21:09
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.243.242.32 (32.242.243.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.243.242.32 (32.242.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 15:21:05.178611 2026] [security2:error] [pid 14525:tid 14525] [client 35.243.242.32:58470] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alkymera.ahijado.org"] [uri "/.git/config"] [unique_id "arwPoQeTtc-V29Us0gRK0gAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-09-29 18:16:29
(2 weeks ago)
{"level":"info","ts":1790705775.7622187,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1790705775.7622187,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.243.242.32","remote_port":"38578","client_ip":"35.243.242.32","proto":"HTTP/1.1","method":"GET","host":"dashboard.status.weap.io","uri":"/.env2","headers":{"Next-Action":["x"],"X-Nextjs-Request-Id":["d36aff3d"],"Cookie":["REDACTED"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"Accept-Encoding":["gzip, deflate"],"Accept":["*/*"],"Connection":["keep-alive"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"dashboard.status.weap.io","ech":false}},"bytes_read":0,"user_id":"","duration":0.000145746,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1790705775.8628309,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.243.242.32"
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 00:18:51
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.243.242.32 (32.242.243.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.243.242.32 (32.242.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 20:18:47.142160 2026] [security2:error] [pid 15705:tid 15705] [client 35.243.242.32:60736] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kengarysp.com"] [uri "/.git/config"] [unique_id "arsD53qjF7dN4Vy7eDj3fAAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Klaverstyn
2026-09-28 23:41:29
(2 weeks ago)
Persistent attacker, repeat offender
Hacking
🇧🇪
cmbplf
2026-09-28 07:08:25
(2 weeks ago)
643 requests with url.path *phpinfo.php
Brute-Force
Bad Web Bot
🇿🇦
conure.sh
2026-09-28 04:55:52
(2 weeks ago)
csagent: score 20.4: secrets grab x2, 404 noise floor x2; 1 domain(s) in 4s
Web App Attack
🇫🇷
dynamix
2026-09-28 04:45:18
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-09-28 04:11:31
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.243.242.32 (32.242.243.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.243.242.32 (32.242.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 00:11:25.585837 2026] [security2:error] [pid 20470:tid 20470] [client 35.243.242.32:53738] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "missingdigit.com"] [uri "/.git/config"] [unique_id "arno7auplYoIq_Qfh2o7yQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Klaverstyn
2026-09-28 03:02:09
(2 weeks ago)
Cross-vhost secrets/RCE probing campaign
Web App Attack
Hacking
2026-09-27 06:53:51
(2 weeks ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-09-25 20:03:38
(3 weeks ago)
[ti-01sc] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-01sc] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.243.242.32 - - [25/Sep/2026:22:03:26 +0200] "GET /.git/config HTTP/1.1" 301 560 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-09-25 03:20:04
(3 weeks ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-25 02:54:50
(3 weeks ago)
35.243.242.32 - - [25/Sep/2026:04:54:47 +0200] "GET /.env.local HTTP/1.1" 404 518 "-" "Mozilla/5.0 ( ...
show more
35.243.242.32 - - [25/Sep/2026:04:54:47 +0200] "GET /.env.local HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
35.243.242.32 - - [25/Sep/2026:04:54:47 +0200] "GET /.env.production HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
35.243.242.32 - - [25/Sep/2026:04:54:47 +0200] "GET /.env.staging HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
35.243.242.32 - - [25/Sep/2026:04:54:47 +0200] "GET /.env.development HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
35.243.242.32 - - [25/Sep/2026:04:54:47 +0200] "GET /.env.test HTTP/1.1" 404 518 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, li
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-25 00:29:02
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.243.242.32 (32.242.243.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.243.242.32 (32.242.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 20:28:54.441902 2026] [security2:error] [pid 16609:tid 16609] [client 35.243.242.32:44234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.whipchecks.com.au"] [uri "/.git/config"] [unique_id "arXARiTGSJLp3-0IF_j3AQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack